package net.lab1024.sa.base.common.domain;

import lombok.Data;
import net.lab1024.sa.base.module.support.target.EventInfoTarget;
import org.springframework.data.annotation.Id;
import org.springframework.data.annotation.Transient;
import org.springframework.data.elasticsearch.annotations.DateFormat;
import org.springframework.data.elasticsearch.annotations.Document;
import org.springframework.data.elasticsearch.annotations.Field;
import org.springframework.data.elasticsearch.annotations.FieldType;

import java.util.Map;

/**
 * 扁平化安全事件实体类 - SOC 安全运营中心
 * Elasticsearch 索引: soc_security_events
 */
@Data
@Document(indexName = "event-base-*")
public class EventBase {

    // ========== 基础元数据 ==========
    @Id
    @Field(name = "event_id", type = FieldType.Keyword)
    @EventInfoTarget( name = "事件id" ,description = "原始事件id")
    private String eventId;

    @Field(name = "es_id", type = FieldType.Keyword)
    @EventInfoTarget( name = "数据id")
    private String esId;

    @Field(name = "@timestamp", type = FieldType.Date, format = DateFormat.epoch_millis)
    @EventInfoTarget( name = "入库时间")
    private long timestamp;

    @Field(name = "event_type", type = FieldType.Keyword)
    @EventInfoTarget( name = "事件类型")
    private String eventType;
    @Field(name = "event_name", type = FieldType.Keyword)
    @EventInfoTarget( name = "事件名称")
    private String eventName;   // 事件名称

    @Field(name = "event_rule", type = FieldType.Keyword)
    private String eventRule;   // 事件规则id
    @Field(name = "event_time")
    private String eventTime;   // 事件时间
    @Field(name = "recive_time")
    private String reciveTime;   // 事件时间

    @Field(name = "severity", type = FieldType.Keyword)
    @EventInfoTarget( name = "危险等级" ,description = "危险等级")
    private String severity;   // 危险等级 (1-5)

    @Field(name = "name", type = FieldType.Keyword)
    private String name;   // 日志来源名称 （火绒，waf，edr）

    // ========== 资产信息 ==========
    @Field(name = "device_name", type = FieldType.Keyword)
    @EventInfoTarget( name = "设备名称" ,description = "设备名称")
    private String deviceName;  //安全设备名称
    @Field(name = "device_ip", type = FieldType.Keyword)
    @EventInfoTarget( name = "设备IP" ,description = "设备ip")
    private String deviceIp;  //安全设备ip
    @Field(name = "attack_packets", type = FieldType.Keyword)
    private String attackPackets;  //攻击报文


    @Field(name = "dst_cmdb_name", type = FieldType.Keyword)
    private String dstCmdbName;  //目的资产名称

    @Field(name = "src_cmdb_name", type = FieldType.Keyword)
    private String srcCmdbName;  //源资产名称

    @Field(name = "src_security_domains", type = FieldType.Keyword)
    private String srcSecurityDomains;   //安全域
    @Field(name = "dst_security_domains", type = FieldType.Keyword)
    private String dstSecurityDomains;   //安全域
    // ========== 源端点信息 ==========
    @Field(name = "src_ip", type = FieldType.Keyword)
    @EventInfoTarget( name = "源ip")
    private String srcIp;       // 源IP地址

    @Field(name = "src_type", type = FieldType.Keyword)
    private String srcType;       // 是否内部资产  0 非 1 是

    @Field(name = "src_port", type = FieldType.Keyword)
    private String srcPort;    // 源端口

    @Field(name = "src_hostname", type = FieldType.Keyword)
    private String srcHostname; // 源主机名

    @Field(name = "src_mac", type = FieldType.Keyword)
    private String srcMac;      // 源MAC地址
    @Field(name = "src_leder", type = FieldType.Keyword)
    private String srcLeader;      //
    // ========== 目标端点信息 ==========
    @Field(name = "dst_ip", type = FieldType.Keyword)
    @EventInfoTarget( name = "目的ip")
    private String dstIp;       // 目标IP
    @Field(name = "dst_leder", type = FieldType.Keyword)
    private String dstLeader;
    @Field(name = "dst_type", type = FieldType.Keyword)
    private String dstType;

    // 是否内部资产  0 非 1 是
    @Field(name = "dst_port", type = FieldType.Keyword)
    private String dstPort;    // 目标端口

    @Field(name = "dst_hostname", type = FieldType.Keyword)
    private String dstHostname; // 目标主机名

    // ========== 用户上下文 ==========
    @Field(name = "user_name", type = FieldType.Keyword)
    private String userName;     // 用户名


    // ========== 网络协议信息 ==========
    @Field(name = "req_method", type = FieldType.Keyword)
    @EventInfoTarget( name = " HTTP方法")
    private String reqMethod;   // HTTP方法

    @Field(name = "req_url", type = FieldType.Keyword)
    @EventInfoTarget( name = "请求URL")
    private String reqUrl;     // 请求URL
    @Field(name = "req_referer", type = FieldType.Keyword)
    @EventInfoTarget( name = "Referer")
    private String reqReferer;     // Referer
    @Field(name = "req_status", type = FieldType.Keyword)
    @EventInfoTarget( name = "HTTP状态码")
    private String reqStatus;  // HTTP状态码

    @Field(name = "req_user_agent", type = FieldType.Keyword)
    @EventInfoTarget( name = "用户代理")
    private String reqUserAgent;   // 用户代理原始字符串

    @Field(name = "req_host", type = FieldType.Keyword)
    private String reqHost;   // 用户代理原始字符串

    @Field(name = "req_header", type = FieldType.Keyword)
    private String reqHeader;
    @Field(name = "reqxff", type = FieldType.Keyword)
    @EventInfoTarget( name = "xff")
    private String reqxff;   // xff

    @Field(name = "req_cookie", type = FieldType.Keyword)
    @EventInfoTarget( name = "cookie")
    private String reqCookie;   // cookie

    @Field(name = "req_xwafuuid", type = FieldType.Keyword)
    private String reqWwafuuid;   // X-WAF-UUID



    // ========== 威胁情报 ==========
    @Field(name = "threat_category", type = FieldType.Keyword)
    private String threatCategory; // 威胁分类

    @Field(name = "threat_signature", type = FieldType.Keyword)
    private String threatSignature; // 威胁特征ID

    @Field(name = "threat_indicators", type = FieldType.Object)
    private Map<String, Object> threatIndicators; // 威胁指标

    // ========== 地理位置 ==========
    @Field(name = "geo_country", type = FieldType.Keyword)
    private String geoCountry;  // 国家

    @Field(name = "srcgeolat", type = FieldType.Keyword)
    private String srcgeolat; // 经纬度

    @Field(name = "srcgeolon", type = FieldType.Keyword)
    private String srcgeolon; // 经纬度 (格式: "lat,lon")

    @Field(name = "srcgeocity", type = FieldType.Keyword)
    private String srcgeocity;     // 城市名称

    @Field(name = "dstgeocountry", type = FieldType.Keyword)
    private String dstgeocountry;  // 国家

    @Field(name = "dstgeolat", type = FieldType.Keyword)
    private String dstgeolat; // 经纬度

    @Field(name = "dstgeolon", type = FieldType.Keyword)
    private String dstgeolon; // 经纬度 (格式: "lat,lon")

    @Field(name = "dstgeocity", type = FieldType.Keyword)
    private String dstgeocity;     // 城市名称
    // ========== 事件==========
    @Field(name = "protocol", type = FieldType.Keyword)
    private String protocol; //协议
    // ========== 原始数据 ==========
    @Field(name = "raw_log", type = FieldType.Text, index = false)
    private String rawLog;      // 原始日志（不索引）
    // ========== 运营字段 ==========
    @Field(name = "blocked", type = FieldType.Keyword)
    private String blocked; // 安全设备处置结果

    @Field(name = "action", type = FieldType.Keyword)
    private String action; // 联动soar 处置结果

    @Field(name = "deviceos", type = FieldType.Keyword)
    private String deviceos; //

    @Field(name = "c_type", type = FieldType.Keyword)
    private String cType; // 连接方式


    //waf 新增



    @Field(name = "query_string", type = FieldType.Keyword)
    private String queryString; // 查询参数


    @Field(name = "payload", type = FieldType.Keyword)
    private String payload; // 攻击payload


    @Field(name = "res_header", type = FieldType.Keyword)
    private String respHeader; // 返回头
    @Field(name = "req_start_time", type = FieldType.Keyword)
    private String reqEndTime; // 请求结束时间

    @Field(name = "req_start_time", type = FieldType.Keyword)
    private String reqStartTime; // 请求开始时间
    /**
     * query_string	Text	是	请求参数
     * response_code	Text	是	返回码
     * response_header	Text	是	返回头
     * response_body	Text	是	返回体
     * srcGeoAddress	Text	是	告警来源（例如鹏博士宽带、阿里云、腾讯云IP.......）
     */
    //edr 火绒

    @Field(name = "white_rule_effect", type = FieldType.Keyword)
    private String whiteRuleEffect; // 是否加白

    @Field(name = "recname", type = FieldType.Keyword)
    private String recname; // 病毒名称\备注\安装软件\软件分类

    @Field(name = "taskname", type = FieldType.Keyword)
    private String taskname; // 查杀类型

    @Field(name = "md5", type = FieldType.Keyword)
    private String md5; // v病毒md5

    @Field(name = "procname", type = FieldType.Keyword)
    private String procname; // 操作进程

    @Field(name = "cmdline", type = FieldType.Keyword)
    private String cmdline; // 操作进程命令行

    @Field(name = "p_cmdline", type = FieldType.Keyword)
    private String pCmdline; // 父进程命令行

    @Field(name = "path_name", type = FieldType.Keyword)
    private String pathName; // event.objec  病毒路径

    @Field(name = "os_type", type = FieldType.Keyword)
    private String osType; // 系统类型

    @Field(name = "res_data", type = FieldType.Keyword)
    private String resData; // 保护内容拓展

    // 聚合统计字段，不映射到ES
    @Transient
    private Map<String, Map<String, Long>> aggregationStats;

    @Field(name = "res_path", type = FieldType.Keyword)
    private String resPath; // 保护路径

    @Field(name = "recnameVal", type = FieldType.Keyword)
    private String recnameVal; // 安装软件名称

    @Field(name = "mail_from", type = FieldType.Keyword)
    private String mailFrom; // 发件人

    @Field(name = "mail_to", type = FieldType.Keyword)
    private String mailTo; // 收件人

    @Field(name = "detail ", type = FieldType.Keyword)
    private String detail; // 防护详情


    @Field(name = "func ", type = FieldType.Keyword)
    private String func; // 防护项目

    @Field(name = "kbid ", type = FieldType.Keyword)
    private String kbid; // 补丁编号

    @Field(name = "level ", type = FieldType.Keyword)
    private String level; // 补丁类型

    @Field(name = "file_operation ", type = FieldType.Keyword)
    private String fileOperation; //

    @Field(name = "organization", type = FieldType.Keyword)
    private String srcorganization;
    @Field(name = "assetName", type = FieldType.Keyword)
    private String srcassetName;

    @Field(name = "organization", type = FieldType.Keyword)
    private String dstorganization;
    @Field(name = "assetName", type = FieldType.Keyword)
    private String dstassetName;
    @Field(name = "host_state", type = FieldType.Keyword)
    private String hostState;//攻击结果


    @Field(name = "confidence", type = FieldType.Keyword)
    private String confidence;//置信度


    @Field(name = "file_name", type = FieldType.Keyword)
    private String fileName;//文件名称(文件)

    @Field(name = "file_type", type = FieldType.Keyword)
    private String fileType;//文件类型
    @Field(name = "subject", type = FieldType.Keyword)
    private String subject;//邮件主题


    @Field(name = "file_size", type = FieldType.Text)
    private String fileSize;//附件大小

    @Field(name = "name_honeypot", type = FieldType.Keyword)
    private String nameHoneypot; //蜜罐名称

    @Field(name = "attack_result", type = FieldType.Keyword)
    private String attackResult;//攻击结果 | 暴破结果

    @Field(name = "attack_type", type = FieldType.Keyword)
    private String attackType;//攻击类型

    @Field(name = "super_type", type = FieldType.Keyword)
    private String superType;// 攻击阶段

    @Field(name = "detail_info", type = FieldType.Keyword)
    private String detailInfo;// 告警详细信息

    @Field(name = "packet_data", type = FieldType.Keyword)
    private String packetData; //载荷内容

    @Field(name = "username", type = FieldType.Keyword)
    private String username;//账号

    @Field(name = "login_count", type = FieldType.Keyword)
    private String loginCount;//成功次数：暴成功次数 | 成功次数

    @Field(name = "passwd", type = FieldType.Keyword)
    private String passwd; //密码

    @Field(name = "rsp_count", type = FieldType.Keyword)
    private String rspCount;//次数:请求OR响应OR发生次数
    @Field(name = "rsp_start_time", type = FieldType.Keyword)
    private String rspStartTime; // 响应开始时间
    @Field(name = "rsp_end_time", type = FieldType.Keyword)
    private String rspEndTime; // 响应结束时间
    @Field(name = "rsp_location", type = FieldType.Keyword)
    private String rspLocation;
    @Field(name = "rsp_code", type = FieldType.Keyword)
    private String rspCode;
    @Field(name = "rsp_body", type = FieldType.Keyword)
    private String rspBody;
    @Field(name = "proxy_address", type = FieldType.Keyword)
    private String proxyAddress; // 代理类型
    @Field(name = "proxy_type", type = FieldType.Keyword)
    private String proxyType;//代理类型

    @Field(name = "tool_type", type = FieldType.Keyword)
    private String toolType; //工具类型

    @Field(name = "sql_stat", type = FieldType.Keyword)
    private String sqlStat; //SQL语句

//规则信息
    @Field(name = "agent_name", type = FieldType.Keyword)
    private String agentName;
    @Field(name = "rule_alert_name", type = FieldType.Keyword)
    private String ruleAlertName;  //规则告警名称
    @Field(name = "rule_batch", type = FieldType.Keyword)
    @EventInfoTarget(name="告警批次")
    private String ruleBatch;   //告警批次

    @Field(name = "rule_alert_level", type = FieldType.Keyword)
    private String ruleAlertlevel;   //威胁等级
    @Field(name = "rule_alert_links", type = FieldType.Keyword)
    private String ruleAlertLinks;   //攻击链
    @Field(name = "rule_alert_result", type = FieldType.Keyword)
    private String ruleAlertResult;  //告警结果
    @Field(name = "rule_alert_reson", type = FieldType.Keyword)
    private String rulAlertReson;   //告警描述
    @Field(name = "rule_alert_disposal", type = FieldType.Keyword)
    private String ruleAlertDisposal;  // =处置建议
    private String rulAlertWhite; // 0 正常
    private String errorStatus;  // 0 不发送异常
    private String logstatus;
    @Field(name = "rule_code", type = FieldType.Keyword)
    private String ruleCode;
    @Field(name = "group_count", type = FieldType.Keyword)
    private String groupCount; //合并数量
    @Field(name = "group_keys", type = FieldType.Keyword)
    private String groupKeys;  //合并属性
    private String eventIndex;

    @Field(name = "req_body", type = FieldType.Keyword)
    private String reqBody;  //请求体

}